From 8e836cea7bdc3009f08df6328dceec8cb9b16cd8 Mon Sep 17 00:00:00 2001 From: Wvisee Date: Wed, 3 Sep 2025 13:29:46 +0200 Subject: [PATCH] Fix typo: corrected 'HTLM' to 'NTLM' Replaced incorrect reference to 'HTLM' with the correct term 'NTLM'. --- .../dpapi-extracting-passwords.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md b/src/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md index 3b6a8a3e8..4f0d15aac 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md +++ b/src/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md @@ -14,7 +14,7 @@ Moreover, these functions accepts also an **`entropy` parameter** which will als ### Users key generation -The DPAPI generates a unique key (called **`pre-key`**) for each user based on their credentials. This key is derived from the user's password and other factors and the algorithm depends on the type of user but ends being a SHA1. For example, for domain users, **it depends on the HTLM hash of the user**. +The DPAPI generates a unique key (called **`pre-key`**) for each user based on their credentials. This key is derived from the user's password and other factors and the algorithm depends on the type of user but ends being a SHA1. For example, for domain users, **it depends on the NTLM hash of the user**. This is specially interesting because if an attacker can obtain the user's password hash, they can: